Help with line-breaking

a212830 — Fri, 16 Mar 2018 20:40:22 GMT

Hi,

I have a feed where it appears that multiple events are being sent on the same line, and I need to break them out. Can someone help me out? The break looks like it should be after the Timestamp, these are all appearing on the same line.

Mar 16 18:44:29 myhostname NTNAME=-SM-XNlwpU2OKY6Z5O9%2fdn3dUlqVlktrStAYeZaWtlO2dtNaD%2f45RYB9%2bb&TARGET=-SM-http%3a%2f%2fshare1%2eapp%2ey%2ecom%2fshare%2fdb%2fGet%2fDocument--2008231%2f s-port=443  cs-username=-   c-ip=x.x.x.x    cs(User-Agent)=Mozilla/5.0+(Windows+NT+6.1;+Win64;+x64;+rv:58.0)+Gecko/20100101+Firefox/58.0    sc-status=200   sc-substatus=0  sc-win32-status=0   time-taken=62 <13>Mar 16 18:44:29 myhostname AgentDevice=MSIIS  AgentLogFile=u_ex180316 AgentLogFormat=W3C  AgentLogProtocol=W3C    date=2018-03-16 time=18:44:23   s-ip=x.x.x.x    cs-method=GET   cs-uri-stem=/siteminder/ntlm/creds.ntc  cs-uri-query=CHALLENGE=&SMAGENTNAME=-SM-mqLlVsTdZPBzRsxcdlQAR2H4%2bN7cc%2ffYvhe2fzHoB1PFt9kRHccU3f3f0&TARGET=-SM-HTTP%3a%2f%2frtn%2eray%2ezebm%2f   s-port=443  cs-username=-   c-ipx.x.x.x cs(User-Agent)=Mozilla/5.0+(Windows+NT+6.1;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko sc-status=401   sc-substatus=2  sc-win32-status=5   time-taken=31 <13>Mar 16 18:44:29 myhostname AgentDevice=MSIIS  AgentLogFile=u_ex180316 AgentLogFormat=W3C  AgentLogProtocol=W3C    date=2018-03-16 time=18:44:23   s-ip=x.x.x.x    cs-method=GET   cs-uri-stem=/sntnder/ntlm/creds.ntc cs-uri-query=CHALLENGE=&SMAGENTNAME=-SM-mqLlVsTdZPBzRKcdlQAR2H4%2bNqhz7cc%2ffYvhe2fzHoB1PFt9kRHccU3f3f0&TARGET=-SM-HTTP%3a%2f%2fozztn%2fzaay%2gcom%2f   s-port=443  cs-username=-   c-ip=x.x.x.x    cs(User-Agent)=Mozilla/5.0+(Windows+NT+6.1;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko sc-status=401   sc-substatus=1  sc-win32-status=2148074254  time-taken=31

Re: Help with line-breaking

somesoni2 — Fri, 16 Mar 2018 21:13:10 GMT

Give this a try

[yourSourceType]
SHOULD_LINEMERGE = false
LINE_BREAKER = (\<\d+\>)
...other timestamp settings...

Re: Help with line-breaking

sloshburch — Wed, 11 Apr 2018 12:56:16 GMT

What's that <13> all about? Is that actually in the data? If so, could this be as easy as breaking there with your LINE_BREAKER?

Re: Help with line-breaking

FrankVl — Wed, 11 Apr 2018 14:07:43 GMT

<13> looks like a syslog priority tag to me (encoding user.notice).

How is this data coming in to your forwarder?

Anyway, I guess you could indeed break on that <\d+>, or to make it a little safer for <...> stuff to occur elsewhere in the event, include part of the timestamp format as well.

topic Help with line-breaking in Getting Data In

Help with line-breaking

Re: Help with line-breaking

Re: Help with line-breaking

Re: Help with line-breaking